leakferret 0.1.3 → 0.1.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +88 -4
- data/lib/leakferret/version.rb +2 -2
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 76c68f883d5148243bbbc769400108fd4acab2dbedfbe4356bc62ffb1ddbd2c7
|
|
4
|
+
data.tar.gz: e9452a82c26c262c521b7810ff7f4db37194c2b6dccfab3536ca602a32795c06
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 5f01616255b47c496492a3103d58ea290741996ac5554dfd1e9865312d13b1ef733e4ec0a0638fcf0d4b0d690331cb759cf0d1a4ecfcc855f6a0f21c7e40c6e6
|
|
7
|
+
data.tar.gz: 52ae9da0cfcfa2532963ade79b5eb63ecd665f37129a0dbe7824a47e83c7b3c8ecdccb347043c5a76083cd20a931b1b3216fb5f4cc8208b24695930f1af96982
|
data/README.md
CHANGED
|
@@ -49,8 +49,9 @@ from your machine to the provider — leakferret has no servers.
|
|
|
49
49
|
gem install leakferret
|
|
50
50
|
```
|
|
51
51
|
|
|
52
|
-
|
|
53
|
-
|
|
52
|
+
The platform binary (`leakferret-{version}-{platform}.tar.gz` from GitHub
|
|
53
|
+
Releases) is downloaded automatically on first use and cached under your home
|
|
54
|
+
directory — no Rust toolchain required.
|
|
54
55
|
|
|
55
56
|
Add it to a `Gemfile` for project-local use:
|
|
56
57
|
|
|
@@ -95,8 +96,91 @@ findings = Leakferret.rewrite('.', backend: 'doppler')
|
|
|
95
96
|
Leakferret.rewrite('.', apply: true)
|
|
96
97
|
```
|
|
97
98
|
|
|
98
|
-
Each `Finding` is a hash with `path`, `line`, `column`, `pattern`, `severity
|
|
99
|
-
`
|
|
99
|
+
Each `Finding` is a hash with `path`, `line`, `column`, `pattern`, `severity`
|
|
100
|
+
(`critical`/`high`/`medium`/`low`), `verdict` (`real`/`fixture`/`unknown`),
|
|
101
|
+
`match_redacted`, `confidence`, `verification`, and `fingerprint`.
|
|
102
|
+
|
|
103
|
+
## Rewrite a leak
|
|
104
|
+
|
|
105
|
+
`rewrite` turns a hardcoded secret into an env-var lookup and helps you move it
|
|
106
|
+
into a secret manager:
|
|
107
|
+
|
|
108
|
+
```bash
|
|
109
|
+
leakferret rewrite . --dry-run-diff # preview the change, touch nothing
|
|
110
|
+
leakferret rewrite . --apply # write `ENV.fetch("KEY")` in place + add to .env.example
|
|
111
|
+
leakferret rewrite . --apply --backend doppler # also print seed commands for your manager
|
|
112
|
+
```
|
|
113
|
+
|
|
114
|
+
`--backend` accepts `env` (default), `vault`, `doppler`, `aws-secrets-manager`,
|
|
115
|
+
`infisical`. By default it only rewrites findings confirmed **REAL/live**; add
|
|
116
|
+
`--include-unknown` to also fix unconfirmed candidates.
|
|
117
|
+
|
|
118
|
+
## Use it in CI
|
|
119
|
+
|
|
120
|
+
leakferret is one binary with clear exit codes (`0` = clean, `1` = findings), so
|
|
121
|
+
it drops into any CI. The recommended pattern: **baseline once**, then `verify`
|
|
122
|
+
on every build so you only fail on *new* secrets.
|
|
123
|
+
|
|
124
|
+
```bash
|
|
125
|
+
# One-time, on a repo that may already have findings:
|
|
126
|
+
leakferret baseline init # fingerprints current findings (HMAC, never the raw secret)
|
|
127
|
+
git add .leakferret-baseline.json # commit it — the per-repo salt is auto-gitignored
|
|
128
|
+
```
|
|
129
|
+
|
|
130
|
+
After that, `verify` ignores anything in the baseline and fails only on new leaks.
|
|
131
|
+
|
|
132
|
+
**GitHub Actions** — use the dedicated action (uploads SARIF to Code Scanning):
|
|
133
|
+
|
|
134
|
+
```yaml
|
|
135
|
+
- uses: leakferrethq/leakferret-action@v1
|
|
136
|
+
with: { path: ., fail-on: any }
|
|
137
|
+
```
|
|
138
|
+
|
|
139
|
+
**CircleCI:**
|
|
140
|
+
|
|
141
|
+
```yaml
|
|
142
|
+
jobs:
|
|
143
|
+
secrets:
|
|
144
|
+
docker: [{ image: cimg/ruby:3.3 }]
|
|
145
|
+
steps:
|
|
146
|
+
- checkout
|
|
147
|
+
- run: gem install leakferret
|
|
148
|
+
- run: leakferret verify . --format sarif > leakferret.sarif
|
|
149
|
+
- store_artifacts: { path: leakferret.sarif }
|
|
150
|
+
```
|
|
151
|
+
|
|
152
|
+
**GitLab CI / Argo Workflows / Jenkins / anything else** — identical recipe:
|
|
153
|
+
|
|
154
|
+
```bash
|
|
155
|
+
gem install leakferret
|
|
156
|
+
leakferret verify . # exits 1 on any REAL finding -> fails the job
|
|
157
|
+
```
|
|
158
|
+
|
|
159
|
+
Useful flags: `--only-verified` (fail only on provider-confirmed live keys),
|
|
160
|
+
`--verify-mode ever-verified` (with a baseline, fail on anything that *ever*
|
|
161
|
+
verified live), `--format sarif|json`.
|
|
162
|
+
|
|
163
|
+
## Use it with AI agents (MCP)
|
|
164
|
+
|
|
165
|
+
leakferret is also an MCP server, so a coding agent (Cursor, Claude, Continue)
|
|
166
|
+
can scan, verify, and rewrite *before it commits*. Add it to your editor's MCP
|
|
167
|
+
config:
|
|
168
|
+
|
|
169
|
+
```json
|
|
170
|
+
{
|
|
171
|
+
"mcpServers": {
|
|
172
|
+
"leakferret": { "command": "leakferret", "args": ["mcp"] }
|
|
173
|
+
}
|
|
174
|
+
}
|
|
175
|
+
```
|
|
176
|
+
|
|
177
|
+
In **Cursor**: Settings → MCP → Add. In **Claude Desktop**: the `mcpServers`
|
|
178
|
+
block of `claude_desktop_config.json`. Tools exposed: `scan_repository`,
|
|
179
|
+
`classify_candidates`, `verify_finding`, `propose_rewrite`, `baseline_diff`.
|
|
180
|
+
|
|
181
|
+
> Running `leakferret mcp` directly in a terminal looks like it hangs — that's
|
|
182
|
+
> correct. It's a stdio JSON-RPC server waiting for your editor to connect, not
|
|
183
|
+
> a command you run by hand.
|
|
100
184
|
|
|
101
185
|
## Using a local binary
|
|
102
186
|
|
data/lib/leakferret/version.rb
CHANGED
|
@@ -2,10 +2,10 @@
|
|
|
2
2
|
|
|
3
3
|
module Leakferret
|
|
4
4
|
# The gem's own version.
|
|
5
|
-
VERSION = '0.1.
|
|
5
|
+
VERSION = '0.1.5'
|
|
6
6
|
|
|
7
7
|
# The native binary release this gem downloads. Tracks the leakferret
|
|
8
8
|
# core release, which may move independently of the gem's own version
|
|
9
9
|
# (e.g. a gem-only bugfix).
|
|
10
|
-
BINARY_VERSION = '0.1.
|
|
10
|
+
BINARY_VERSION = '0.1.3'
|
|
11
11
|
end
|